quay/ai-helpers/fix-konflux-stdlib

KONFLUX_DIR="/tmp/quay/quay-konflux-components"
KONFLUX_REPO="${CVE_KONFLUX_REPO:-quay/quay-konflux-components}"
gh repo clone "$KONFLUX_REPO" "$KONFLUX_DIR" -- --depth=50 2>/dev/null || true
cd "$KONFLUX_DIR"
git checkout main && git pull origin main

CONTAINERFILE="${KONFLUX_DIR}/${KONFLUX_COMPONENT%/}/Containerfile"
CURRENT_TAG=$(grep 'go-toolset' "$CONTAINERFILE" | head -1 | sed -n 's/.*go-toolset:\([^[:space:]]*\).*/\1/p')
AVAILABLE_TAGS=$(skopeo list-tags \
  "docker://registry.access.redhat.com/ubi9/go-toolset" 2>/dev/null | \
  jq -r '.Tags[]' | sort -V)
TAG_PREFIX=$(echo "$CURRENT_TAG" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
LATEST_TAG=$(echo "$AVAILABLE_TAGS" | grep "^${TAG_PREFIX}" | tail -1)

sed -i "s|go-toolset:${CURRENT_TAG}|go-toolset:${LATEST_TAG}|g" "$CONTAINERFILE"

FIX_BRANCH="fix/cve-${CVE_ID}-go-stdlib-${REPO_NAME}-attempt-1"
git checkout -b "$FIX_BRANCH"
git add "$CONTAINERFILE"
git commit -m "fix(cve): ${CVE_ID} - bump go-toolset for ${REPO_NAME} (${JIRA_KEY})
 
- Update go-toolset from ${CURRENT_TAG} to ${LATEST_TAG}
- Addresses Go stdlib vulnerability in ${PACKAGE}
 
Resolves: ${JIRA_KEY}"
git push origin "$FIX_BRANCH"